'\" t
.\"     Title: ndbxfrm
.\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\"      Date: 09/19/2025
.\"    Manual: MySQL Database System
.\"    Source: MySQL 9.5
.\"  Language: English
.\"
.TH "NDBXFRM" "1" "09/19/2025" "MySQL 9\&.5" "MySQL Database System"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
ndbxfrm \- compress, decompress, encrypt, and decrypt files created by NDB Cluster
.SH "SYNOPSIS"
.HP \w'\fBndbxfrm\ \fR\fB\fIoptions\fR\fR\fB\ \fR\fB\fIfilenames\fR\fR\ 'u
\fBndbxfrm \fR\fB\fIoptions\fR\fR\fB \fR\fB\fIfilenames\fR\fR
.SH "DESCRIPTION"
.PP
The
\fBndbxfrm\fR
utility can be used to decompress, decrypt, and output information about files created by NDB Cluster that are compressed, encrypted, or both\&. It can also be used to compress or encrypt files\&.
.PP
Usage
.sp
.if n \{\
.RS 4
.\}
.nf
ndbxfrm \-\-info \fIfile\fR[ \fIfile\fR \&.\&.\&.]
ndbxfrm \-\-compress \fIinput_file\fR \fIoutput_file\fR
ndbxfrm \-\-decrypt\-password=\fIpassword\fR \fIinput_file\fR \fIoutput_file\fR
ndbxfrm [\-\-encrypt\-ldf\-iter\-count=#] \-\-encrypt\-password=\fIpassword\fR \fIinput_file\fR \fIoutput_file\fR
.fi
.if n \{\
.RE
.\}
.PP
\fIinput_file\fR
and
\fIoutput_file\fR
cannot be the same file\&.
Options
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-compress\fR,
\fB\-c\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--compress
T}
.TE
.sp 1
Compresses the input file, using the same compression method as is used for compressing NDB Cluster backups, and writes the output to an output file\&. To decompress a compressed
NDB
backup file that is not encrypted, it is necessary only to invoke
\fBndbxfrm\fR
using the names of the compressed file and an output file (with no options required)\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-decrypt\-key=\fR\fB\fIkey\fR\fR,
\fB\-K\fR
\fIkey\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--decrypt-key=key
T}
.TE
.sp 1
Decrypts a file encrypted by
NDB
using the supplied key\&.
.if n \{\
.sp
.\}
.RS 4
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
This option cannot be used together with
\fB\-\-decrypt\-password\fR\&.
.sp .5v
.RE
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-decrypt\-key\-from\-stdin\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--decrypt-key-from-stdin
T}
.TE
.sp 1
Decrypts a file encrypted by
NDB
using the key supplied from
stdin\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-decrypt\-password=\fR\fB\fIpassword\fR\fR
.TS
allbox tab(:);
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--decrypt-password=password
T}
T{
Type
T}:T{
String
T}
T{
Default Value
T}:T{
[none]
T}
.TE
.sp 1
Decrypts a file encrypted by
NDB
using the password supplied\&.
.if n \{\
.sp
.\}
.RS 4
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
This option cannot be used together with
\fB\-\-decrypt\-key\fR\&.
.sp .5v
.RE
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-decrypt\-password\-from\-stdin[=TRUE|FALSE]\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--decrypt-password-from-stdin
T}
.TE
.sp 1
Decrypts a file encrypted by
NDB, using a password supplied from standard input\&. This is similar to entering a password after invoking
\fBmysql\fR
\fB\-\-password\fR
with no password following the option\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-defaults\-extra\-file\fR
.TS
allbox tab(:);
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--defaults-extra-file=path
T}
T{
Type
T}:T{
String
T}
T{
Default Value
T}:T{
[none]
T}
.TE
.sp 1
Read given file after global files are read\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-defaults\-file\fR
.TS
allbox tab(:);
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--defaults-file=path
T}
T{
Type
T}:T{
String
T}
T{
Default Value
T}:T{
[none]
T}
.TE
.sp 1
Read default options from given file only\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-defaults\-group\-suffix\fR
.TS
allbox tab(:);
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--defaults-group-suffix=string
T}
T{
Type
T}:T{
String
T}
T{
Default Value
T}:T{
[none]
T}
.TE
.sp 1
Also read groups with
CONCAT(\fIgroup\fR, \fIsuffix\fR)\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-detailed\-info\fR
.TS
allbox tab(:);
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--encrypt-block-size=#
T}
T{
Type
T}:T{
Boolean
T}
T{
Default Value
T}:T{
FALSE
T}
.TE
.sp 1
Print out file information like
\fB\-\-info\fR, but include the file\*(Aqs header and trailer\&.
.sp
Example:
.sp
.if n \{\
.RS 4
.\}
.nf
$> \fBndbxfrm \-\-detailed\-info S0\&.sysfile\fR
File=/var/lib/cluster\-data/ndb_7_fs/D1/NDBCNTR/S0\&.sysfile, compression=no, encryption=yes
header: {
  fixed_header: {
    magic: {
      magic: { 78, 68, 66, 88, 70, 82, 77, 49 },
      endian: 18364758544493064720,
      header_size: 32768,
      fixed_header_size: 160,
      zeros: { 0, 0 }
    },
    flags: 73728,
    flag_extended: 0,
    flag_zeros: 0,
    flag_file_checksum: 0,
    flag_data_checksum: 0,
    flag_compress: 0,
    flag_compress_method: 0,
    flag_compress_padding: 0,
    flag_encrypt: 18,
    flag_encrypt_cipher: 2,
    flag_encrypt_krm: 1,
    flag_encrypt_padding: 0,
    flag_encrypt_key_selection_mode: 0,
    dbg_writer_ndb_version: 524320,
    octets_size: 32,
    file_block_size: 32768,
    trailer_max_size: 80,
    file_checksum: { 0, 0, 0, 0 },
    data_checksum: { 0, 0, 0, 0 },
    zeros01: { 0 },
    compress_dbg_writer_header_version: { \&.\&.\&. },
    compress_dbg_writer_library_version: { \&.\&.\&. },
    encrypt_dbg_writer_header_version: { \&.\&.\&. },
    encrypt_dbg_writer_library_version: { \&.\&.\&. },
    encrypt_key_definition_iterator_count: 100000,
    encrypt_krm_keying_material_size: 32,
    encrypt_krm_keying_material_count: 1,
    encrypt_key_data_unit_size: 32768,
    encrypt_krm_keying_material_position_in_octets: 0,
  },
  octets: {
     102, 68, 56, 125, 78, 217, 110, 94, 145, 121, 203, 234, 26, 164, 137, 180,
     100, 224, 7, 88, 173, 123, 209, 110, 185, 227, 85, 174, 109, 123, 96, 156,
  }
}
trailer: {
  fixed_trailer: {
    flags: 48,
    flag_extended: 0,
    flag_zeros: 0,
    flag_file_checksum: 0,
    flag_data_checksum: 3,
    data_size: 512,
    file_checksum: { 0, 0, 0, 0 },
    data_checksum: { 226, 223, 102, 207 },
    magic: {
      zeros: { 0, 0 }
      fixed_trailer_size: 56,
      trailer_size: 32256,
      endian: 18364758544493064720,
      magic: { 78, 68, 66, 88, 70, 82, 77, 49 },
    },
  }
}
.fi
.if n \{\
.RE
.\}
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-encrypt\-block\-size=\fR\fB\fI#\fR\fR
.TS
allbox tab(:);
lB l
lB l
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--encrypt-block-size=#
T}
T{
Type
T}:T{
Integer
T}
T{
Default Value
T}:T{
0
T}
T{
Minimum Value
T}:T{
0
T}
T{
Maximum Value
T}:T{
2147483647
T}
.TE
.sp 1
Size of input data chunks that are encrypted as a unit\&. Used with XTS; set to
0
(the default) for CBC mode\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-encrypt\-cipher=\fR\fB\fI#\fR\fR
.TS
allbox tab(:);
lB l
lB l
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--encrypt-cipher=#
T}
T{
Type
T}:T{
Integer
T}
T{
Default Value
T}:T{
1
T}
T{
Minimum Value
T}:T{
0
T}
T{
Maximum Value
T}:T{
2147483647
T}
.TE
.sp 1
Cipher used for encryption\&. Set to
1
for CBC mode (the default), or
2
for XTS\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-encrypt\-kdf\-iter\-count=\fR\fB\fI#\fR\fR,
\fB\-k \fR\fB\fI#\fR\fR
.TS
allbox tab(:);
lB l
lB l
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--encrypt-kdf-iter-count=#
T}
T{
Type
T}:T{
Integer
T}
T{
Default Value
T}:T{
0
T}
T{
Minimum Value
T}:T{
0
T}
T{
Maximum Value
T}:T{
2147483647
T}
.TE
.sp 1
When encrypting a file, specifies the number of iterations to use for the encryption key\&. Requires the
\fB\-\-encrypt\-password\fR
option\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-encrypt\-key=\fR\fB\fIkey\fR\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--encrypt-key=key
T}
.TE
.sp 1
Encrypts a file using the supplied key\&.
.if n \{\
.sp
.\}
.RS 4
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
This option cannot be used together with
\fB\-\-encrypt\-password\fR\&.
.sp .5v
.RE
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-encrypt\-key\-from\-stdin\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--encrypt-key-from-stdin
T}
.TE
.sp 1
Encrypt a file using the key supplied from
stdin\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-encrypt\-password=\fR\fB\fIpassword\fR\fR
.TS
allbox tab(:);
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--encrypt-password=password
T}
T{
Type
T}:T{
String
T}
T{
Default Value
T}:T{
[none]
T}
.TE
.sp 1
Encrypts the backup file using the password supplied by the option\&. The password must meet the requirements listed here:
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Uses any of the printable ASCII characters except
!,
\*(Aq,
",
$,
%,
\e,
`, and
^
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Is no more than 256 characters in length
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Is enclosed by single or double quotation marks
.RE
.sp
.if n \{\
.sp
.\}
.RS 4
.it 1 an-trap
.nr an-no-space-flag 1
.nr an-break-flag 1
.br
.ps +1
\fBNote\fR
.ps -1
.br
This option cannot be used together with
\fB\-\-encrypt\-key\fR\&.
.sp .5v
.RE
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-encrypt\-password\-from\-stdin[=TRUE|FALSE]\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--encrypt-password-from-stdin
T}
.TE
.sp 1
Encrypts a file using a password supplied from standard input\&. This is similar to entering a password is entered after invoking
\fBmysql\fR
\fB\-\-password\fR
with no password following the option\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-help\fR,
\fB\-?\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--help
T}
.TE
.sp 1
Prints usage information for the program\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-info\fR,
\fB\-i\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--info
T}
.TE
.sp 1
Prints the following information about one or more input files:
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
The name of the file
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Whether the file is compressed (compression=yes
or
compression=no)
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
Whether the file is encrypted (encryption=yes
or
encryption=no)
.RE
.sp
Example:
.sp
.if n \{\
.RS 4
.\}
.nf
$> \fBndbxfrm \-i BACKUP\-10\-0\&.5\&.Data BACKUP\-10\&.5\&.ctl BACKUP\-10\&.5\&.log\fR
File=BACKUP\-10\-0\&.5\&.Data, compression=no, encryption=yes
File=BACKUP\-10\&.5\&.ctl, compression=no, encryption=yes
File=BACKUP\-10\&.5\&.log, compression=no, encryption=yes
.fi
.if n \{\
.RE
.\}
.sp
You can also see the file\*(Aqs header and trailer using the
\fB\-\-detailed\-info\fR
option\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-login\-path\fR
.TS
allbox tab(:);
lB l
lB l
lB l.
T{
Command-Line Format
T}:T{
--login-path=path
T}
T{
Type
T}:T{
String
T}
T{
Default Value
T}:T{
[none]
T}
.TE
.sp 1
Read given path from login file\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-no\-login\-paths\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--no-login-paths
T}
.TE
.sp 1
Skips reading options from the login path file\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-no\-defaults\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--no-defaults
T}
.TE
.sp 1
Do not read default options from any option file other than login file\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-print\-defaults\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--print-defaults
T}
.TE
.sp 1
Print program argument list and exit\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-usage\fR,
\fB\-?\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--usage
T}
.TE
.sp 1
Synonym for
\fB\-\-help\fR\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
\fB\-\-version\fR,
\fB\-V\fR
.TS
allbox tab(:);
lB l.
T{
Command-Line Format
T}:T{
--version
T}
.TE
.sp 1
Prints out version information\&.
.RE
.PP
\fBndbxfrm\fR
can encrypt backups created by any version of NDB Cluster\&. The
\&.Data,
\&.ctl, and
\&.log
files comprising the backup must be encrypted separately, and these files must be encrypted separately for each data node\&. Once encrypted, such backups can be decrypted only by
\fBndbxfrm\fR,
\fBndb_restore\fR, or
\fBndb_print_backup\fR\&.
.PP
An encrypted file can be re\-encrypted with a new password using the
\fB\-\-encrypt\-password\fR
and
\fB\-\-decrypt\-password\fR
options together, like this:
.sp
.if n \{\
.RS 4
.\}
.nf
ndbxfrm \-\-decrypt\-password=\fIold\fR \-\-encrypt\-password=\fInew\fR \fIinput_file\fR \fIoutput_file\fR
.fi
.if n \{\
.RE
.\}
.PP
In the example just shown,
\fIold\fR
and
\fInew\fR
are the old and new passwords, respectively; both of these must be quoted\&. The input file is decrypted and then encrypted as the output file\&. The input file itself is not changed; if you do not want it to be accessible using the old password, you must remove the input file manually\&.
.SH "COPYRIGHT"
.br
.PP
Copyright \(co 1997, 2025, Oracle and/or its affiliates.
.PP
This documentation is free software; you can redistribute it and/or modify it only under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the License.
.PP
This documentation is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
.PP
You should have received a copy of the GNU General Public License along with the program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or see http://www.gnu.org/licenses/.
.sp
.SH "SEE ALSO"
For more information, please refer to the MySQL Reference Manual,
which may already be installed locally and which is also available
online at http://dev.mysql.com/doc/.
.SH AUTHOR
Oracle Corporation (http://dev.mysql.com/).
